Why do I still have to enter password after I ente

问题:

I'm learning Ansible, in a setup document : http://docs.ansible.com/intro_getting_started.html

It says if I don't want to enter password every time, I can do :

$ ssh-agent bash
$ ssh-add ~/.ssh/id_rsa

I did it, but how come I still have to enter password every time ? Then it says "you may wish to use Ansible’s --private-key option", but I can't find any document on that. Whay's that for and how to do it ?

回答1:

I'm not sure about Ansible, but I know a bit about how ssh keys work

When you generate a new SSH key with the ssh-keygen command (which by default goes to the ~/.ssh/id_rsa file), it asks you to put in a passphrase(password)
Whenever you use that key, it will ask you for that passphrase.

If you create a new key with

$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): /home/YOUR_USERNAME/.ssh/id_rsa_nopass
Enter passphrase (empty for no passphrase): [just press enter, don't type anything]
Enter same passphrase again: [just press enter again]

This will create both an id_rsa_nopass private key file, and an id_rsa_nopass.pub public key file in the directory you chose (/home/user/.ssh)

You should then be able to use the following command, assuming ansible is set up to use your ssh keys correctly

$ ssh-add ~/.ssh/id_rsa_nopass

NOTE: Using an ssh key without a passphrase can be dangerous, as anybody can access your device and connect without knowing your password. If you don't mind this, then a no-passphrase ssh key is a good way to avoid typing a password everyone

edit: Just looked into Ansible a bit, it's basic setup is just to run a command on an ssh server, right?
In which case, you may need to add your public key to whichever server you are connecting to, this can usually be done via the command

ssh-copy-id -i /path/to/your/public/key/file [e-mail] -p your_server's_ssh_port

For example, to authorize the id_rsa_nopass key from earlier to the account foobar on the server example.org, with ssh port 10022 you would do

ssh-copy-id -i ~/.ssh/id_rsa_nopass.pub [e-mail] -p 10022

This will prompt you for the password to [e-mail], upon filling in the password it will authorize that public key to connect to that server, and since id_rsa_nopass has no passphrase, you should now be able to connect without any password prompt